﻿#ifndef PROCMAN_H
#define PROCMAN_H

#include <ntddk.h>
#include "gen.h"

typedef struct _DEVICE_EXTENSION
{
    HANDLE hProcessHandle;
    PKEVENT pProcessEvent;
    HANDLE hParentID;
    HANDLE hProcessID;
    BOOLEAN bCreate;
}DEVICE_EXTENSION,*PDEVICE_EXTENSION;

//自定义函数声明
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath);
NTSTATUS ProcmonDispatchClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS ProcmonDispatchCreate(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp); 
VOID CPNUnload(IN PDRIVER_OBJECT DriverObject); 
NTSTATUS ProcmonDispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
VOID ProcessCallback(IN HANDLE hParentId, IN HANDLE hProcessId, IN BOOLEAN bCreate);

#endif